UK Patent Application ,«,GB ,,,,2365252 ,,3, A 

(43) Date of A Publication 13.02.2002 



(21) 


Application No 0011201.1 


lO II 


INTCL^ 










H04L 12/24 12/26 




(22) 


Date of Rling 09.05.2000 










(52) 


UK CL (Edition T ) 








H4KKFMA 




\fV 


AppiicanTisi 










3Com Corporation 


(56) 


Documents Cited 






(Incorporated in USA - Delaware) 




EP 0535270 A1 


WO 98/25377 A1 




5400 Bayfront Plaza, M/S 1308, Santa Clara, 




WO 97/37292 A2 


WO 93/10495 A1 




California 95052-8145, United States of America 












(58) 


Reld of Search 




(72) 


Inventor(s) 




UK CL (Edition R ) H4K KFM , H4P PEUX 




Peter 1 Oliver 




INT CL^ H04L 12/24 12/26 12/56 , H04Q 3/00 




Ronald Brown . 




Online: EPODOC, JAPK), WPI 




MarlcAPearce 








(74) 


Agent and/or Address for Service 










Brookes Batchellor 










102-108 Clerkenwell Road, LONDOM EC1M 5SA. 










United Kingdom 









(54) Abstract Htle 

Network nnaftagement system user Interfeoe which presents graphs of conversation information in 
response to user selection 

(57) A network management system has a user interface 9 which includes areas for listing network devices 
by name and/or address 17 and displaying a network map 15. A user can select a device or group of devices 
from the list(s) or map and in response graphs are produced In the display areas 21, 23 and 25. These graphs 
relate to the communications traffic (ie conversations) between devices. The graphs are typically bar graphs 
and may be ordered according to the volume of traffic. The graphs may display a summary of the information 
for a group of devices 21, information for a particular device 23 or information regarding a particular pair of 
devices 25. The bar graphs may be broken down into colour coded blocks dependent upon the protocol used 
for the conversation(s). 
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CALCULATE SUMMARY 
CHART AS THE SUM 
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INVOLVING ANY 
SELECTED NEIWORK 
ELEMENT OR ANY 
NEIWORK ELEMENT 
THAT IS SUBSUMED BY 
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CALCULATE TOPMOST NEIWORK 
EUMENTS AS THE UST OF NEIWORK 
ELEMENTS SUBSUMED BYTHE 
SELECTED GROUP. ORDER UST BY 
VOLUME OF CONVERSATION 
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APPARATUS AND METHOD FOR AUTOMATICATXY PRESENTING 
SIGNinCANT DATA TN RESPONSE TO USER SELECTION IN NETWORK 

MANAGEMENT SYSTEMS 

BACKGROUND OF THE INVENTION 
Field of the Invention 

The present invention relates to an ^paratus and method for presenting data in 
response to user selection, and in particular, but not exclusively, to an apparatus and 
method which graphically presents network management data relating to network 
devices according to selection by the user. 

Description of the Related Art 

Network management systems collect and process data relating to the 
operation of a network. This application describes management systems for con5)uter 
networks, such as local area networks (LANs) and wide area networks (WANs), but it 
will be appreciated that it may be appfcable to other types of data communicatbns 
networks. 

Computer networks typically comprise a phnrality of network devices 
inchiding computers, peripherals and other electronic devices capable of 
communicating with each other by sending and receiving data packets in accordance 
with predefined network protocols. Each network device on the network is connected 
to the network media, which in the case of a LAN network may be coaxial cable, 
twisted pair cable or fibre optic cable. A network is genially configured with core 
devices having a phurality of ports, which can be used to interconuect a phmdity of 
media links on the networic Such devtees include hubs, switches and routm which 
pass data packets received at one port to one or more of its other ports, depending 
iq)on the type of device. 

A computer network may be managed by a network management system 
which monitors data traffic, composing one or more strategically placed monitors or 
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"probes" on the network. These "probes" monitor data packets transfenred across the 
network and collect data relating to "conversations" between network devices. Whilst 
the monitoring of conversations is typically carried out by a dedicated monitoring 
device, the skilled person will appreciate that the monitoring may be carried out by a 
5 managed network device such as a managed hub or switch, as is well known in the 
; art. 

Such a network management system fiirther con5>rises a network management 
station which periodically retrieves the coDected data from the "probes", processes the 

10 data and stores it in a database or other data storage file. The network managonent 
station typically con^jrises a covapmet or computer system with the necessary 
hardware and software to carry out the network management fimctions, mchiding the 
necessary memory capacity to store data in the database. The network management 
station typically presents data from the database to the user by means of a 

15 conventional display screea The data may be presented in a variety of different 
forms based on selection 1^ the user. 

For exanq>le, the data may be presented on the display screen in the form of a 
>TSual "nap" of circles representing groups of related devices vwth points or icons 
20 within the circles representing individual networic devices within the groups. Lines 
between circles and/or icons within the circles represent monitored "conversations". 
The tiiickness of the lines may be used to mdkate the quanti^ of data transferred 
during the conversation and diff»ent cotours may be used for the Imes to indkate the 
protocol used in the conversation. 

25 

In aiK)ther example, ffzphs may be used to present information on the display 
screen about partbular conversations selected by the user. For example, data may be 
presented for conversations involving a sdected device or groiq> of devices. 

30 In each case, the us« is required to select the mazma of presentation of the 

m^pagpinent informatbtt and to identii^ the devices or groiq)s of devices of interest 



and to which the management information should relate. 

A difiSculty with the above described network management system is that the 
user may spend considerable time deciding which devices or groups of devices are of 
interest, and may spend time viewing presentations of data which are not significant, 
or which do not present the data in a useful and understandable manner, before the 
significant data and most use&lmanner of presentatbn of the data is found. 

The present invention seeks to overcome these shortcomings. 

SUMMARY OF THE INVENTION 

In accordance with a first aspect, the present invention provides a method for 
presenting data conqjridng the steps ofi generating at least one graph representing 
data relating to a data object, in response to selection of the data object by a user, the 
user enploying a graphical representation of a phttality of data objects m making the 
selection, and simultaneously presenting the at least one gr^h with the gr^hical 
representatbn. 

In this way, the network user is automatically presented widi a gr^h 
representing data relating to the selection without having to make fiirther selections 
for the disphy of such data 

In accordance with a secovd aspect, the present invention provides a computer 
program for carrying out tiie method of the first aspect of the presMt invention. 

RRTFF DESCRi m^^ THE DRAWINGS 

F^ure 1 is a block diagram showing a networic management system in 
accordance with the present invration; 

Figure 2 is a schematic view of the presentation regions for presentation of 
management data on a display screen of a network management station in accordance 
with a preferred embodiment of the present invention; 



4 



Figures 3 to 9 are illustrative views of the presentation of management data on 
a display screen of a network management station in accordance with a preferred 
embodiment of the present invention, showing different user selections, and 

Figure 10 is a flow diagram showing the steps performed by a computer 
S program in accordance widi a method according to the present inventioa 

DESCRIPTION OF THE PREFERRED EMBODIMENTS 

Figure I shows a network management system 1 m accordance with a 
preferred embodiment of the present invention. The management system 1 comprises 

10 a plurality of monitors or probes 3 situated at strategic locations on a network 5. In 
the illustrated embodiment, the network S comprises three local area networks 
(LANs), which are managed by the network mans^ement system 1. These LANs 
include devices which are members of domains having the domain names 
"DomainA.com" indicated by the reference 6, "DomainB.com" indicated by the 

IS reference numeral 8 and "DomainC.com" indicated by the reference numeral 10. It 
will be appreciated that other network configurations are possible. For escample, onlh^ 
one probe 3 may be required if it can be positioned at a location to monitor all 
conversations involving devices on the network, as described below. 

20 The networic management system 1 further comprises a network m ana g ement 

station 7 having a processor (CPU) 11 for processing management data and memory 
12 inchadiog random access memory (RAM), a disk drive and a database 14 for 
storii^ the management data. The management station 7 further con^rises user 
inter&ces 16 such as a display screen 9, a keyboard and a mouse. 

25 

The network management system 1 uses the Sinqple Network Management 
Protocol (SNMP) to communicate management data. SNMP defines agents, 
managers and MIBs ("wbete MIB is Management Informatk)n Base), as well as 
various predefined messages and commands for data communication. An agent is 
30 present in each managed network device and stores management data, responds to 
requests fiom the manager and may send a message to the manager after sensing a 
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predefined condition. A manager is present within the network management station 
of a network and interrogates the agents of managed devices on the network xising 
various SNMP commands, to obtain man2^ement information A MIB is a managed 
object database which stores management data obtained by managed devices, 
5 acces^Ie to agents for network management applications. In the preferred 
embodunent, the NOBs enq)byed are RMON (Remote Monitoriog MIB as defined in 
RFC1271) and RM0N2 (Remote Monitoring MIB vcrsion2 as defined in RFC2021) 

It will be appreciated that the preset invention is not restricted to 
10 management using SNMP and data sources other than those described betow may be 
used. 

In accordance with the preferred embodiment, probes 3 include SNMP agents 
which collect RMON and/or RM0N2 data. Management station 7 includes an SNMP 

1 S manager which periodically retrieves the RM0N/RM0N2 data fix>m all the probes 3 » 
for exanq)le, every 30 minutes, fi>r conversations which have occurred during a 
preceding time interval, as explained below. The management station 7 processes the 
data and stores it in the database 14, usmg conventional techniques, for exanqple as 
described in UK Patent Application GB 2 337 903A, which is incoipoiated herein by 

20 reference. 

More specifically, the management station 7 stores data about "conversations" 
(Le. data communications) between two devices on the network which have been 
"seen" by the probes 3, hereinafter called "conversation data". Conversation data 

25 inchides, fi)r eadi conversation, the identity of the two devices mvoKed in the 
conversation, the start time and end time of the conversation, the quantity of data 
transferred during the conversation and the protocols used. This information is 
obtained by probes 3 throt^ obsorvii^ tiie data packets transferred during the 
conversation. For exan^le, the leader ofeach data packet win contain an address for 

30 the source device and an address for tiie destination device. The protocols employed 
can simibrly be obtained firom information in the data packets. The number of data 
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packets transferred during each conversation can be counted by the probe. The start 
time and end time of the conversation can be noted by the probe and, in a preferred 
embodiment a "timestamp" appUed to the conversation data to indicate the time 
interval (for example the hour or half hour) in which the conversations occurred. The 

5 timestamp is then used for identifying the data for conversatfons in the relevant time 
: interval when the management station 7 retrieves the data from the probes 3. 
Conversation data is indexed in the database by inter alia the device identifier 
("Device ID" or "Olgect ID") for the two devices involved in the conversation, v»1iich 
may be an identifier for an mdividual device invoked in the conversation or the 

10 identifier for a group of devices which includes an indwidual device involved in the 

conversatiorL 

The network management station 7 may be operated to display on its display 
screen 9 selected conversation data from the database 14. For exanq>le, the user may 

15 use the keyboard or mouse to select data for monitored conversations over a specified 
time interval, which may be the time period for which the management station 7 has 
been monitoring the network 5 or may be based on a daily, weekly or monthly time 
interval Muhiple time intervals m^ be selected by the user. In accordance with the 
preferred embodiment, the data retrieved fiwm the probes 3 for each time interval is 

20 stored m a separate record in the database. This means that whca the user makes a 
sdection of one or more time intervals, the management station can copy the records 
felling within each q)ecified time intervd fi»m the dat*ase 14 and store the lec^ 
in a first cache area of the memory 12 fiw use during management operations. In 
particular the cached data is used in calculations to generate an appropriate displqr of 

25 the data as described bebw. 

In accordaiKe with the present invention, networic management data is 
amuttaneousty displayed in a plaaiSty of diflFerait grq>hical forms. 



30 



Figure 2 schematjcally illustrates the dispLqr area of display screen 9 of the 
networic management statton 7 in accordance with the preferred emibodimenL The 
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display area includes a toolbar area 19, a map area 15, a list area 17 and a graph area 
20. 

The main, centralfy located display area, map area 15, is used to display a 
"map" representing the traffic on the network 5, in which circles represent groups of 
5 related network devices, icons within the circles represent individual network devices 
within the groiq>s and lines between circles and/or icons represent monitored 
conversations. 

The list area 17 is used to display a list of names of network devices diown on 
10 the map in map area 15. It wD be appreciated that this area naay list the devices by 
other identifiers such as IP address. The list area 17 is shown to the left hand side of 
the map in the display area of Figure 2. 

The graph area 20 comprises three graph regions, and is located on the right 
IS hand side of the rasp in the display area of Figure 2. The graph area 20 is used to 
display graphs of data relating to network devices selected by the user usang the map 
mthemapareal5ortfaelistinthe]istareal7. The graph r^ons in the graph area 
20 are Summary Region 21, Top Obgects Region 23, and Top Connections Region 25. 
In accordance with the pre&nred embodiment, the networic management station 7 
20 automatically generates and presents graphs in each of these regions according to the 
device or group of devices selected by the user firom the list region 17 ai^or the map 
region 15. Thus the user is automatically presented with usefiil graphs relatii^ to the 
selected devices or groiq>s of devices. 

25 The graphs generated in each of the graph regions will now be described, and 

the manner of generation of the graphs, using the data in the database 14, in 
accordance with the preferred embodiment of the present invmtion will then be 
described 

30 In accordance with ibo prefened embodnnent the graphs comprise bar diarts 

which present the managonent data and more particular^ the conversation data for a 
selected time period It wiH be appreciated that other fonns of graph may be used to 
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present the data, and the present invention is not limited to the use of bar charts. The 
bar charts comprise bars, each bar representing a particular network device or group 
of network devices and the length of each bar represents the quantity of data packets 
sent and received by the particular device or group during monitored conversations 
5 over a prespecified time period More specifically, each bar is a stacked bar 
comprising a series segments stacked together in a linear array to form the bar. Each 
segment of a bar represents the quantity of data packets sent and received by the 
particular device or group represented by the bar using a particukir network protocol 
The segments within a bar may be distinguished from each other by the use of 
10 different colours for different protocols. The sum of the segments in a particular bar 
thus represents the total quantity of data packets sent and received by the particular 
device or group of devices during conversations in the specified time period. 

Summary Region 

15 The bar chart presented in the Summaiy Region 21 represents data &r all the 

conversations in the specified time period for the device or group of devices selected 
using the map or list As illustrated, for exanq)le in Figure 4 in which a single device 
named "ha22ardD0mainA.com" is selected, the graph is a bar chart comprising a 
single stacked bar that displays the sum of all of the data trafBc entering and leaving 

20 the selected device "ha2zard.DomainA.com'\ Each element or segment of the stacked 
bar represents an individual network protocol or named group of network protocols 
used in monitored conversations mvolving the device "hazzardJDomainA.com", and 
the length of each segment represents the quanti^ of data (in bytes, as indicated 
above the bar) transferred in conversations using the relevant protocol Le. the vohime 

25 of trafBc involving the devices. 

Top Objects Region 

The bar chart presented in the Top Objects Region 23 represents the 
conversations involving each device within the selected device or groiq) of devices. 
30 Each bar represents the monitored conversations mvolving a particiilar device within 
the device or groups of devices selected using the map or list The bars are presented 
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in the bar chart in oider by volume (Le. length of bar) with the longest bar at the top 
of the bar chart and the shortest bar at the bottom. Thus, the most active, and 
therefore significant, devices m terms of conversation volume are presented at the top 
of the bar chart. The number of bars in the bar chart in the Top Objects Region is 
5 lixnited, in the preferred embodiment to 50, so that data for devices within the 
selection which are conq)arativeIy inactive, and therefore less significant to the user, 
are omitted from the chart It will be appreciated that the number of bars displayed 
may be chosen by the user and is typical^ in the regbn of 10 to 100. This graph is a 
stacked bar chart that contains multq>le bars; each bar represmts a "significant 
10 device" or collapsed groiq) (as discussed in more detail below). As with the bar chart 
in the Summary Region 21, each element or segment of each stacked bar represents 
an individual network protocol or named group of network protocols. 

The contents of the bar chart in the Top Objects Region 23 change as follows 
15 depending on the context of the selection. 

When a single device is selected, as ^wn in Figure 4 (or a colk^^sed group is 
selected as shown in Figure 9) the bar chart singly contains the sum of all of the 
traffic entering, leaving, or contained within the selected device (or coflapsed grotp). 
20 Thus in Figure 4, where the device "hazzard.DomamA.com" is selected, the bar chart 
contains a single bar representing all the conversatbns involving Hhazzard". In other 
words it is a duplicate of the bar chart in the Summary Region. 

When a smgle group of devices (not collapsed) is selected, as shown in the 
25 Figure 5, the bar chart shows the conversations involving the most active devices 
contained withm tte selected groiq>, ord^ed by volume of conversation data. Each 
bar represents the sum of the traffic entering or leaving each "child'' device within the 
selected group. Thus, in Figure 5, vfbsn the groiq> of devices "DomainA" are 
selected, the bars represent the individual devices within the groiq), of which the top 
30 device, which has involved the transfer of the most conversation data is liazzard", 
and the next most active device in terms of conversation data vohmie is "stoker". 
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Thus, h can be seen that this graph allows the user to rapidly identify the devices 
within the groiq) which are consuming the most network resources. 

If multiple devices are selected, as shown in Figure 6 (or multiple groiq)S are 

5 selected as shown in Figure 7), each bar in the bar chart represents the sum of data 

traffic enterii^, leaving, or contained whhin a single device (or group) fiom the 

selection. The bars are sorted by volume of traffic. Thus, as shown in Figure 6, in 

which the devices "hazzaid", "stoker" and "ryan" are selected, each device is 

represented a single bar, thus Ae bar chart includes three bars revealing 

10 information relating to the data traffic invohdng each of the devices. As will be 

a|)preciated, selecting muh^jle devices and/or grovps albws the user to quickfy 

compare selected devices and/or groups. Thus, it can be seen from Figure 6 that the 

device "ryan" is consuming conaderably feww network resources compared to the 

active devices "hazzard" and "stoker". 

15 . . 

Finalfy, if a combination of devices and grotq>s is selected, as shown m Figure 

8, each bar in the bar chart rq>resents the sum of data tra£Bc entering, leaving, or 
contained within a selected device or a selected group. The bars are sorted by vohime 
of traffic. Thus, as shown in Figure 8, in which the device "www.DomainB.com" is 
20 selected in combination with the group "DomainA", the device "www" is represented 
by a single bar, and the group "DomainA" is represented by a single bar. Thusthebar 
chart includes only two bars revealing infonnatbn relatmg to the data traffic 
invohong tile selected device and tiie selected group. 

25 Top Connections Regions 

The graph presented in the Top Connections Region 25 rqjresents the 
connections between each selected netwodc device, or each netwodc device within a 
selected group of network devices, and other network devices on the network, wMch 
are carrying the most networic traffic. Thus, each bar represents the monitored 

30 conversations on a particular "connection" le. conversations between two network 
devices, at least one of which is within the selection. This graph coaprises stacked 
bars in a bar chart, eadi bar rqiresenting a "significant" visible network connection. 
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and each element of each stacked bar representing the individual network protocoKs). 
In accordance with a preferred embodiment of the present invention, a "significant" 
connection is defined as one which consumes a high volume of network traffic and 
flie bars within the bar chart are sorted by order of volume of network trafSc (highest 
vohime at top). As with the graph in the Top Objects Region, in the preferred 
embodiment, only the 50 busiest connections that are attached to selected devices 
and/or groiqps are presaited in the bar chart 

The contents of this bar chart in the Top Connectfons Region 25 change as 
foOows depemUng on the context of the selection. 

When a angle device is selected, as shown in Figure 4 (or a collapsed gpyvp is 
selected as shown in Figure 9, and described betow) the bar chart inchides a bar fi)r 
each of the devices which have been connected to the selected device during 
monitoring. Thus in Figure 4, where the device "hazzard" is selected, the bar chart 
contains bars representing conversations with "hazzard", "stoker" and "monroe". 
These three bars in the bar chart represent all the conversations involving "hazzard". 
It win be ^rcciated that fijr devices having conversations with a large number of 
devices, only the 50 busiest connections, in terms of volume of data trafBc, would be 
presented. 

When a single group of devices (not coTlapstS) is sekcted, as shown m the 
Figure 5, the bar chart shows the conversations invoWing the devices within the 
selected group and other devices on the networic, ordered by vohime oonvosation 
data. Each bar represents the traffic transfenred between each "child" device wdrin 
the selected groiq) and another device. Thus, in Figure 5, where the group of devices 
"DomainA" is selected, tije bars represent connections involving devices within the 
groiq) "DomainA". The top bar illustrates the connection between "hazzard" and 
"stoker", showing Aat conversatbns between these two devices have invoNed the 
transfer of the most conversation data, and the bottom bar ilhistrated in the view of 
Figure 5 shows, the connection between "software.DomahiC.oom" and 
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"cobum.DoinainA.com" which has involved the transfer of considerably less 
conversation data. 

If multiple devices are selected, as shown in Figure 6 (or multiple groups are 
selected as shown in Figure 7). each bar in the bar chart lepiesenls the data tiafBc 
transferred between a "child" device within the selected group and another device, 
vdth the bars sorted by volume of trafBc. Thus, as shown in Figure 6. in which the 
devices -bazzard", "stoker" and "lyan" are selected^ data relating to conversations 
imroWing each device and another device is represented by a single bar. Thus.aswith 

Figure 5, the top bar iUustrates the connection between "hazzard" and "stoker", since 
monitored conversations between these two devices have invoWed the transfer of the 
most conversation data. TTms next bar represents conversations involving tiie devices 
"ryan" and "hazzard" which have involved considerably less data traffic. 

Finally, if a combmation of devices and groups is selected, as shown in Figure 
8. each bar in the bar chart represents the data traffic transferred between a selected 

device or a "child" device within a selected group and another device, with tiw bars 
sorted by volume of traffic. Thus, as shown in Figure 8, in which the device 
-www.DomainB.com" is selected in combination with the group "DomainA", data 
relating to conversations invoMng "DomainB" and each device within the group 
"DomainA- and another device is represented by a single bar. Thus, as wiUi Figure 5, 
the top bar ilhistrates the connection between "bazzard" and "stoker", wWch are both 
"child" devfces of the selected group "DomainA" since monitored conversations 
between these two devices have imroKed the transfer of tiie most conversation data. 
The next bar represents conversations invoking the devfccs "lyan" and "hazzard", 
also witiiin tiie group "DomainA- which have invoked considerd)ty less dat^ 



rrtlla psed GrouD 

Figure 9 illustrates tiie selection is a "collapsed" group of devices. A 
collapsed group is one in which all of the data relating to -chDd" devices within the 
group has been aggregated and represented as a angle entity on tiie map. Whendata 
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relating to grovq)s of devices are collapsed, in response to user request, the 
management station 7 performs a calculation to aggregate the data relatii^ to the 
group of devices for presentation on the map in map area 15 and in the associated 
graphs in graph area 20. Specifically, the data for the selected time intervals, which is 
stored in a first cache area of noemory 12, as previous^ desoibed, is aggregated to 
relate to the grotq> and stored in a second cache area m memory. This data in the 
second cache area thus relates to "groiq) to groiqp" conversations, in contrast to data m 
the first cache area which relates to "device to device" conversations. As will be 
{^eciated, the data in the first cache area, and in database 14, remains unaffected by 
tiie collapsing of devices, thus enabling tiw user to reverse tiie collapsing so that 
devices within the collapsed group can be represented individual^ on the map, and 
their corresponding data displayed in the graph area 20. 

As aq>lained above, collapsed groq)s are treated as smgle devices for the 
generation of the graphs m the Summary Regbn 21, the Top Objects Regbn 23 and 
the Top Connections Regbn 25. Thus, in Figure 9, in which the collsqpsed group 
"DomainA" is selected, the Summary Regbn 21 represents data fi>r all tiie 
conversations involving "child" devices witiiin tiie selected collapsed gn>vq;> of de^nces 
"DomainA". The graph is a bar chart conqtrismg a single stacked bar that displ^ the 
sum of all of the data traflBc entering, leaving and contained witiiin the selected 
collq)sed groxqi "DomainA". Each element or segment of the stacked bar represents 
an individual network protocol or named group of network protocols used in 
monitored coaversatfons involving the colkq)sed group "DomainA", and the lengtii of 
eadi segmoit represents tiie quantity of data (in bytes, as indicated above the bar) 
transferred in conversations using the relevant protocol Le. the vohmae of trafiBc 
involving tiie devices. The grsph in tiie Top Otgects Regbn 23 is the same, since tiie 
collapsed grotqi "DomainA" is treated as a single device, and thus tiie "chiki" devices 
witiutt the groiq) are not treated indhdduatty. Finally, tiie gtiqih in tiie Top 
Connections Regbn 25 represoits conversatbns between the collapsed gioiq> 
"DomainA" and extonal devices. Since the only extonal devices represoited m the 
map are also colkq?sed groiqps, namety tiie groiq)S "DomainB" and "DomainC", tiie 
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two bars shown in the graph in the Top Connections Region of Figure 9 related to 
conversations between the collapsed groups "DomainA** and "DoroainB** and 
"DomainA** and "DomainC". 

5 Method of the Prefened Embodiment 

Figure 10 is a flow diagram illustrating the method used by the network 
management station 7 for presenting management data and in particular conversatin 
data as illustrated in Figures 2 to 9 in accordance with a preferred embodiment of the 
present invention. The method steps are preferably carried out by a computer 
10 program running in the network manag^nent station 7» but it will be appreciated that 
in other embodiments the method may be implemented by other means such as in 
hardware. 

The program of Figure 10 generates grs^hs in the graph area 20 in response to 
15 selection of a device or group of devices by the user from the map or list. Such 
selection is perfomied by the user using the user interfaces 16, for example by a 
predetermined keystroke using a keyboard or by clicking on a mouse over the 
representation of the device on the map/list in the display area of display screen 9. 

20 The program starts at step 100 in response to change in the selection by the 

user. At stq> 101, the program considers \^dietfaer there are one or more devices or 
groups of devfees selected on the map. If step 101 determines that there is no 
selection the program contmues with step 103, in which the program clears the gr^h 
area 20 of the display area of display screw 9 by presenting a blank area in place of 

25 any existing graphs (as shown in Figure 3), and the program ends at step 115. 
Alternatively, if step 101 determines that a selection exists, the program continues 
with step 103. 

At step 103, the program considers whether a single element (Le. a single 
30 device or collapsed group of devices) has been selected. If step 103 detenmines that a 
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single element is selected, the program continues with program steps 104 to 106, as 
described below. Otherwise the program continues with step 108. 

At step 108, the program considers vvdiether a single groiq) of devices (not 
collapsed) has been selected. If step 108 determines that a angle group of devices is 
selected, tiie program continues with program steps 109 to 111, as desaibed betow. 
Otherwise the program determines that multiple devwes/groups are selected, and the 
program continues with steps 1 12 to 1 14, as described bdow. 

Steps 104 to 106 are performed when a single element (ie. a sangle device or a 
angle collapsed group) is selected, as shovwi by way of exansph in F^ure 4 and 
Figure 9. In step 104, the program retrieves data for all the monitored conversations 
involving the selected element If a time interval has been selected by the user, this 
data is retrieved from the first or second cache area of die memory as described 
above. \Jmg this data, the program calculates the sum of the vohmie of data trafBc 
for different network protocols fi>r the conversations and generate a stad^d bar 
chart, as previously described, representing the total data trafBc for presentation in the 

Summary Region 21 . 

In step 105, the program reproduces the stacked bar chart generated in stq> 
104 for the Top Directs Region 23. 

In step 106, the program sorts the conversation data involving the setected 
cwigle device according to the other device involved in the conversation. The sorted 
data thus relates to a oonnectkm between the setected device (or collapsed ffovp) and 
another singte device (or collapsed group). The sorted data is then ordered according 
to tiafBc vohmK for each connectbn of tiie 50 counectbns invohrii^ the most data 
tiaflBc and the program generates a bar, ordered according to data trafBc vohane, for 
presentation in a bar chart in the Top Connectbns Region 25. Once stq>s 104 to 106 
are conq)leted, and three gr^hs l^ve been generated, the program continues with step 
107. 
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In step 107, the program presents the generated graphs in the appropriate 
regions on the display screen 9. In the case of the graphs in the Top Objects and Top 
Connections Regions, where there may be insuflScient room in the "window" 
5 associated with the graph region to display all the bars in the bar charts, the top part of 
: the chart is presented, and the bar chart can be scrolled using a scroll bar associated 
with the window of the graph region 20. 

Steps 109 to 111 are performed when a single group of elements is selected, as 
10 shown by way of example in Figure 5, in which a single group of devices is selected. 
It win be appreciated that the single groiq> way invohre collapsed groups, for exanq>le 
if the single group "com" were selected fiom the map of Figure 9. 

In step 109, the program retrieves data for all the monitored conversations 
15 mvolving devices within the selected group of elements. If a time interval has been 
selected by the user, this data is retrieved fiom the cache area of the memory 12 as 
described above. Using this data, the program calculates the sum of the volume of 
data trafSc for dififerent network protocols for the conversations. The program uses 
this calculation to generate a stacked bar chart as previously described, tiie bar chart 
20 representii^ fhe total data traffic involving the groqp (ie. between elements in the 
group and between an element in the group and an element outside the groiq>) for 
presentation in the Summary Region 21. 

In step 110, the program sorts the conversation data involving the selected 
25 group of elements (devices and/or collapsed groups) by element Thus for a selected 
group of devices, the data is sorted according to the "child" device within the group 
involved in the convasatk>n. For the selection of a group includmg collapsed groi^>s, 
the dat a is sorted collapsed group and not duld device. The sorted data for each 
eloient therefore relates to data traffic for a particular "cbiki** device wft^ 
30 or data traffic for a collapsed group. The sorted data is then ordered accoidSrig to 
traffic vohime and, for each of the 50 elements (devices or coUqpsed groiq[>s) 
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involving the most data traffic, the program generates a bar, for presentation in a bar 
chart in the Top Objects Region 23 and ordered according to data trafiBc volume. 

In step 111, the program sorts the conversation data involving the selected 
groiQ) of elements (devices and/or collapsed gfovps) according to the connection, le. 
accordii^ to the two elanoits invoWed in the conversation. The sorted data for each 
connection relates to data traffic across a connection between an element in the 
selected group and another sii«le element (single device or colIq)sed group). The 
sorted data for the connection is then ordered acconUng to traffic volume and for eadi 
of the 50 connections invohong the most data traffic, the program generates a bar, for 
presentation in a bar chart in the Top Connections Regbn 25 and ordered according to 
data traffic vohime. Once steps 109 to 1 1 1 are completed, and three graphs have been 
generated, the program continues with step 107, as described above. 

Steps 112 to 114 are peiformed, by definilt, when neither a ^gle element 
(device or collapsed grotq>) nor a angle group is selected le. vibtn muhq)le devices 
and/or collapsed gtovps and/or groiq)s of devices are selected. Exanq>Ies of this type 
of selection are shown in Figures 6, 7 and 8. 

For this type of selection, a group of devices is treated as a collq)sed groi^ 
(Le. the conversation data is aggregated, as previously described) in the prefened 
embodiment. However, it will be predated that in other embodiments it could be 
treated in the same way as m die previously described selections. 

In step 112, tl» program retrieves data for all the monitored conversations 
involving the selected multiple devices, collapsed grouis and groups. If a time 
interval has been selected by the user, this data is retrieved fiom the first or second 
cache area of memory as described above. Using this data, the program calculates the 
sum of the vohime of data traffic for dififerent netwoik inotocols for the conversations 
and generates a stacked bar diart, as previous^ desoibed, representing Ae total data 
traffic for the selected mnhiple devices, collapsed groups and groups of devices for 
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presentation in the Summaiy Region 21. 

In step 1 13, the program sorts the conversation data involving the selected 
multiple devices, collapsed groups and groups of devices according to element Le. 
single devices and collapsed groiqjs involved in the conversation. The sorted data for 
each element therefbie relates to data traffic mvolving a particular selected single 
device or collapsed group (which could be a selected coU^sed group or a selected 
groi^ of devices). The sorted data is then ordexed according to traflSc vohmw and for 
each of the 50 elonents invohnng the most data traflSc, the program generates a bar, 
ordered according to data traffic vohmie, for presentation in a bar chart m the Top 
Objects Re^on 23. 

In step 114 the program sorts the conversation data involving the selected 
niultq)le devices, collapsed groups and groiqw of devices accordmg to connection, Le. 
according to the two elements involved in the conversation. The sorted data for each 
connection therefore relates to data traffic across a connection between one of the 
selected devices or ooDapsed ffovps and anoth» sii^ element (single device or 
collapsed grot^). The sorted data is then ordered according to traffic votame and for 
each of the 50 connections involving fbc most data trafiSc, the program generates a 
bar, ordered accoidmgto datatraflfic vohmie, forpresoitationinabar chart in the Top 
Connections Region 25. Once steps 112 to 114 are completed, and three graphs have 
been generated, the program contmues wifli step 107, as described above. 

The coiiq)uter program of the preferred embodimoit may be provided on a 
computCT readable medhmi such as a magnetic or optical disk which may be loaded 
into the disk drive of the networic management station. Altemativefy, the computer 
program may be carried on a computa system having a website vAach pennits 
downloading of fl» computer program over the Internet on a carrier wave to Ae 
networic man^ement station. 
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It will be appreciated that various modifications and changes may be made to 
the described embodiment. For example, whilst the graphs of the described 
embodiments indicate data quantity for nionitored conversations they could equally 
well represent the time duration of monitored convorsations. In addition the data 
could be sorted in manners other than by votome order, such as accordmg to protocol 
ortime. Also, the data could be stored in the database or oth^ data storage accord 
to the time of coOection from the probes rather than accordiiig to a timestamp 
indicating the time interval m which the conversation occurred It is intended to 
include all such variations, modifications and eqmvalents which M within the spirit 
and scope of the present invention as defined in the accompanying claims. 
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CLAIMS: 

1. A method for presenting data cony)rising the steps of: receiving an indication 
of the selection of a data object by a user, the user employing a graphical 

5 representation of a plxirality of data objects having associated data in making the 
selection, and automatically generating at least one graph representing data relating to 
the selected data object in re^onse to the received indicatba 

2. A n^thod as claimed in claim 1, wherein prior to the step of generating, the 
10 method further conpises the step of: retrieving data ftom a data storage, ^vherein the 

data is stored in the data storage with a corresponding tnne. 

3. A method as claimed in claim 2, wherein the at least one graph comprises a 
bar chart showing all available data relating to the selected data object for a 

1 5 prespecified time period. 

4. A method as claimed in claim 3, wherein the data conqyrises network 
management data and each of the plurality of data objects relate to an individual 
netwoik device or a group of network devices. 

20 

5. A method as claimed in claim 1, wherein the data conqxrises networic 
mflnagftment data and each of the plurality of data otgects relate to an individual 
network device or a group of network devices. 

25 6. A method as claimed in claim 5, wherein the at least one graph conq)rises a 
bar chart showing the data assockited with each network device within the selected 
dataotgect 

7. A method as claimed in claim 6, v4ierein the bar chart conqirises a bar 
30 representing data for each netwoiic device. 
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8* A method as claimed in claim 5, ^rein the network managenient data relates 
to monitored conversations involving the phuality of data objects, the data for each 
conversation including the volume of data transferred during the conversation and the 
identity of two devices involved in the conversatioa 

5 

9* A method as claimed m claim 8, wherein the at least one graph comprises a 
bar chart, each bar ^wing the data relating to conversations between two network 
devices, wherein the selected data object inchides at least one of the two networic 
devices. 

10 

10 A method as claimed in claim 1, wherein prior to the stqp of receiving an 
indication, the method fiuther comprises the step of: retrievmg data for a prespecified 
time period, and caching the data m a cache storage. 

15 11. A method as claimed in claim 10, ^^iierein after the step of receiving the 
indication, the method fiirther comprises the step o£ extracting data fn>m the cache 
storage relatiqg to the selected data object, and usmg the extracted data to generated 
the at least one gr^h. 

20 12* A method as claimed in claim 11, wherein the data conq)rises network 
management data and each of the phnality of data objects relate to an individual 
network device or a group of network devices; the Ktwork management data relating 
to monitored conversadons involving the phirality of data objects, the data for each 
conversation including the volume of data transferred during the conversation and the 

25 identity of two devices involved in the conversation; 

wherein the at least one graph conq)rises: 

a summary grsqph conqsrising bar chart showing the data associated with each 
network device within the selected data olqect; 

a device gr^h comprising a bar chart ^wing the data associated with each 
30 network device within the selected data object, and 
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a conversation graph comprising a bar chart, each bar showing the data 
relating to conversations between two network devices, wherein the selected data 
object includes at least one of the two network devices. 

13. A method as claimed in claim 12, further comprismg the step of: 
simultanBOusly presenting the at least one graph with the graphical representation. 

14. A method as claimed in claim 13, wherein the device gr^h conq)rises a bar 
for each of a predetermined number of network devices, the method forther 
comprising the steps of: for each network device, determining the sum of the volume 
of data transferred during converSatmns invoWing the network device, and selecting 
for inclusion in the device graph the predetermined number of network devices having 
the largest sums. 

15. A method as claimed in claim 13, wherem the conversation graph comprises a 
bar for each of a predetermmed nunaber of network connecdons between two network 
devices, the method fiirther comprising the steps o£ for each network connectfon, 
determining the sum of the volume of data transferred during conversations invohnng 
the two network devices, and selecting for inclusion in the conversations graph the 
predetermined number of network connectfons having the largest sums 

16. A method as cbimed in claim 1, fiirther compriang the step o£ 
simnkaneously presenting the at least olograph vwth the graphical rqiresentation. 

17. A method as claimed in claim!, wherein the gr^hicalrepiesentatton used to 
select the data olgect is selected from the group consisting o£ a list of the names of 
the plurality of data objects; a list of the addresses of the phnality of data objects, and 
a map illustrating the ptorality of data objects. 

18 A method as claimed in claim 1, wherein the graphical representation is 
presented on a display screen and the indication of the selection is provided in 
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response to user interaction selected from the group con^sting o£ a keystroke; a 
mouse click or pressure applied to the screen. 

19. A computer program for presenting data in a user operable system in which a 
5 user employs a graphical representation of a plurality of data objects for selecting a 
data object, the plurality of data objects havixig associated data for presentation, the 
program conq>ris]ng: a program step for receivixig an indication of the selection of a 
data object by a user» and a program step for automatically generating at least one 
graph representing the associated data for the selected data object in response to the 
1 0 receded indication. 
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